systex | 523d243e593d50922d2fe685ea4c4b3d5b65a46512dda7deec278b8fdd45850e

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/07/2026, 21:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260713-1jty6abs21
SHA256 523d243e593d50922d2fe685ea4c4b3d5b65a46512dda7deec278b8fdd45850e
MD5 a07bde57266dc3f7aad90bf6ef3a7d99
SHA1 249fdaaae3e4ae48e4c5b97608952155f58e7109
SHA512 88b30eb7a5351849d8a20f4dfd94d90f5d4f0c3e8bdfc815da72df19d80bbbad0c836e96f82e58c926d144726f0db18575063bed2c9d310a482d21372f4b3fc1
SSDEEP 6144:TflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:TflfAsiVGjSGecvX
TLSH
T156747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
928	ytrljdbvtolgeywq.exe
804	ytrljdbvtolgeywq.sys
5960	CreateProcess.exe
2896	bywigeytnj.exe
4444	CreateProcess.exe
5312	CreateProcess.exe
364	i_bywigeytnj.exe
3340	wqligavtql.sys
4216	CreateProcess.exe
1808	lfdbvtnlfd.exe
1280	CreateProcess.exe
3856	CreateProcess.exe
5512	i_lfdbvtnlfd.exe
5972	ifaysqkifa.sys
5324	CreateProcess.exe
4204	faxvpnifay.exe
2504	CreateProcess.exe
4352	CreateProcess.exe
5444	i_faxvpnifay.exe
2564	pnkfaxvpki.sys
6024	CreateProcess.exe
248	icausmkicx.exe
4340	CreateProcess.exe
4652	CreateProcess.exe
2328	i_icausmkicx.exe
460	usmkfcxupf.sys
1072	CreateProcess.exe
2404	fzxrpkhcau.exe
1368	CreateProcess.exe
2904	CreateProcess.exe
5016	i_fzxrpkhcau.exe
1124	eczusmhfzx.sys
944	CreateProcess.exe
4348	pmhezxrpjh.exe
5444	CreateProcess.exe
2380	CreateProcess.exe
2400	i_pmhezxrpjh.exe
2044	pjhbztrmjh.sys
1036	CreateProcess.exe
2336	hbztrmkebw.exe
2900	CreateProcess.exe
5964	CreateProcess.exe
5540	i_hbztrmkebw.exe
1672	uomgeztrlj.sys
2752	CreateProcess.exe
1056	jdbwtrljdy.exe
3296	CreateProcess.exe
552	CreateProcess.exe
3708	i_jdbwtrljdy.exe
972	tqligeywql.sys
5852	CreateProcess.exe
2876	ligbytrljd.exe
4244	CreateProcess.exe
4528	CreateProcess.exe
2564	i_ligbytrljd.exe
2340	ljdbvqoiga.sys
4312	CreateProcess.exe
1568	vqnigaysql.exe
3384	CreateProcess.exe
2180	CreateProcess.exe
3820	i_vqnigaysql.exe
3144	sqoigaysqk.sys
3936	CreateProcess.exe
2692	kidavtnlfd.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5716_2000522702\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5716_2000522702\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5716_429382440\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5716_429382440\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5716_2057609281\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5716_2057609281\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5716_429382440\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5716_429382440\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5716_647455524\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqoigbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bywigeytnj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxvpnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxrpkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqnigaysql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywtoljgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bywigeytnj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxrpkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywtoljgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqoigbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbztrmkebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqnigaysql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcxspkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhezwupmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olfdbvtqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbztrmkebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbwtrljdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kidavtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cavsnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcxspkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomhezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebwuomgeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olfdbvtqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdbvtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbwtrljdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kidavtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cavsnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytrljdbvtolgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxvpnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icausmkicx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdbvtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icausmkicx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ligbytrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhezwupmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomhezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ligbytrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebwuomgeb.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
252	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4128	ipconfig.exe
292	ipconfig.exe
4660	ipconfig.exe
1912	ipconfig.exe
4804	ipconfig.exe
704	ipconfig.exe
1144	ipconfig.exe
5856	ipconfig.exe
4128	ipconfig.exe
2372	ipconfig.exe
4440	ipconfig.exe
8	ipconfig.exe
6088	ipconfig.exe
2572	ipconfig.exe
552	ipconfig.exe
5400	ipconfig.exe
2680	ipconfig.exe
4620	ipconfig.exe
1408	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134284524841512845"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{36502258-4A61-477B-ABA4-758A91E5BD82}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
928	ytrljdbvtolgeywq.exe
928	ytrljdbvtolgeywq.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
928	ytrljdbvtolgeywq.exe
928	ytrljdbvtolgeywq.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
928	ytrljdbvtolgeywq.exe
928	ytrljdbvtolgeywq.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
928	ytrljdbvtolgeywq.exe
928	ytrljdbvtolgeywq.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
928	ytrljdbvtolgeywq.exe
928	ytrljdbvtolgeywq.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5716	msedge.exe
5716	msedge.exe
5716	msedge.exe
5716	msedge.exe
5716	msedge.exe
5716	msedge.exe
5716	msedge.exe
5716	msedge.exe
5716	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	364	i_bywigeytnj.exe
Token: SeDebugPrivilege	5512	i_lfdbvtnlfd.exe
Token: SeDebugPrivilege	5444	i_faxvpnifay.exe
Token: SeDebugPrivilege	2328	i_icausmkicx.exe
Token: SeDebugPrivilege	5016	i_fzxrpkhcau.exe
Token: SeDebugPrivilege	2400	i_pmhezxrpjh.exe
Token: SeDebugPrivilege	5540	i_hbztrmkebw.exe
Token: SeDebugPrivilege	3708	i_jdbwtrljdy.exe
Token: SeDebugPrivilege	2564	i_ligbytrljd.exe
Token: SeDebugPrivilege	3820	i_vqnigaysql.exe
Token: SeDebugPrivilege	1004	i_kidavtnlfd.exe
Token: SeDebugPrivilege	1356	i_cavsnlfdxv.exe
Token: SeDebugPrivilege	3600	i_fcxspkhcau.exe
Token: SeDebugPrivilege	3340	i_mhezwupmhe.exe
Token: SeDebugPrivilege	4856	i_wuomhezwrp.exe
Token: SeDebugPrivilege	4628	i_jebwuomgeb.exe
Token: SeDebugPrivilege	1132	i_geywtoljgb.exe
Token: SeDebugPrivilege	4996	i_olfdbvtqli.exe
Token: SeDebugPrivilege	1124	i_sqoigbvtnl.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5716	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 928	3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 3672 wrote to memory of 4092	3672	2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 4092 wrote to memory of 5716	4092	iexplore.exe	90
PID 5716 wrote to memory of 940	5716	msedge.exe	91
PID 5716 wrote to memory of 2528	5716	msedge.exe	92
PID 5716 wrote to memory of 252	5716	msedge.exe	93
PID 5716 wrote to memory of 2528	5716	msedge.exe	92
PID 5716 wrote to memory of 2528	5716	msedge.exe	92
PID 5716 wrote to memory of 52	5716	msedge.exe	94
PID 5716 wrote to memory of 52	5716	msedge.exe	94
PID 5716 wrote to memory of 3940	5716	msedge.exe	96
PID 5716 wrote to memory of 3940	5716	msedge.exe	96
PID 5716 wrote to memory of 3940	5716	msedge.exe	96
PID 5716 wrote to memory of 1472	5716	msedge.exe	97
PID 5716 wrote to memory of 1472	5716	msedge.exe	97
PID 5716 wrote to memory of 1472	5716	msedge.exe	97
PID 5716 wrote to memory of 2660	5716	msedge.exe	98
PID 5716 wrote to memory of 2660	5716	msedge.exe	98
PID 5716 wrote to memory of 2660	5716	msedge.exe	98
PID 5716 wrote to memory of 1764	5716	msedge.exe	99
PID 5716 wrote to memory of 1764	5716	msedge.exe	99
PID 5716 wrote to memory of 1764	5716	msedge.exe	99
PID 5716 wrote to memory of 2096	5716	msedge.exe	100
PID 5716 wrote to memory of 2096	5716	msedge.exe	100
PID 928 wrote to memory of 5960	928	ytrljdbvtolgeywq.exe	104
PID 2896 wrote to memory of 4444	2896	bywigeytnj.exe	107
PID 5716 wrote to memory of 3372	5716	msedge.exe	110
PID 5716 wrote to memory of 3372	5716	msedge.exe	110
PID 5716 wrote to memory of 4068	5716	msedge.exe	111
PID 5716 wrote to memory of 4068	5716	msedge.exe	111
PID 5716 wrote to memory of 1196	5716	msedge.exe	113
PID 5716 wrote to memory of 1348	5716	msedge.exe	114
PID 5716 wrote to memory of 1348	5716	msedge.exe	114
PID 928 wrote to memory of 5312	928	ytrljdbvtolgeywq.exe	117
PID 5716 wrote to memory of 1128	5716	msedge.exe	118
PID 5716 wrote to memory of 1128	5716	msedge.exe	118
PID 928 wrote to memory of 4216	928	ytrljdbvtolgeywq.exe	123
PID 1808 wrote to memory of 1280	1808	lfdbvtnlfd.exe	125
PID 928 wrote to memory of 3856	928	ytrljdbvtolgeywq.exe	128
PID 928 wrote to memory of 5324	928	ytrljdbvtolgeywq.exe	132
PID 4204 wrote to memory of 2504	4204	faxvpnifay.exe	134
PID 928 wrote to memory of 4352	928	ytrljdbvtolgeywq.exe	137
PID 928 wrote to memory of 6024	928	ytrljdbvtolgeywq.exe	142
PID 248 wrote to memory of 4340	248	icausmkicx.exe	144
PID 928 wrote to memory of 4652	928	ytrljdbvtolgeywq.exe	147
PID 5716 wrote to memory of 3296	5716	msedge.exe	149
PID 5716 wrote to memory of 872	5716	msedge.exe	150
PID 5716 wrote to memory of 2752	5716	msedge.exe	151
PID 928 wrote to memory of 1072	928	ytrljdbvtolgeywq.exe	154
PID 2404 wrote to memory of 1368	2404	fzxrpkhcau.exe	156
PID 5716 wrote to memory of 5360	5716	msedge.exe	159
PID 5716 wrote to memory of 5360	5716	msedge.exe	159
PID 5716 wrote to memory of 5360	5716	msedge.exe	159
PID 5716 wrote to memory of 6108	5716	msedge.exe	160
PID 5716 wrote to memory of 6108	5716	msedge.exe	160
PID 5716 wrote to memory of 6108	5716	msedge.exe	160
PID 928 wrote to memory of 2904	928	ytrljdbvtolgeywq.exe	161
PID 928 wrote to memory of 944	928	ytrljdbvtolgeywq.exe	165
PID 4348 wrote to memory of 5444	4348	pmhezxrpjh.exe	167
PID 928 wrote to memory of 2380	928	ytrljdbvtolgeywq.exe	170
PID 928 wrote to memory of 1036	928	ytrljdbvtolgeywq.exe	174
PID 2336 wrote to memory of 2900	2336	hbztrmkebw.exe	176
PID 928 wrote to memory of 5964	928	ytrljdbvtolgeywq.exe	179
PID 928 wrote to memory of 2752	928	ytrljdbvtolgeywq.exe	183

C:\Users\Admin\AppData\Local\Temp\2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-13_a07bde57266dc3f7aad90bf6ef3a7d99_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Temp\ytrljdbvtolgeywq.exe
  C:\Temp\ytrljdbvtolgeywq.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:928
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bywigeytnj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5960
  - - C:\Temp\bywigeytnj.exe
      C:\Temp\bywigeytnj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2896
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4444
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6088
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bywigeytnj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5312
  - - C:\Temp\i_bywigeytnj.exe
      C:\Temp\i_bywigeytnj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:364
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lfdbvtnlfd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4216
  - - C:\Temp\lfdbvtnlfd.exe
      C:\Temp\lfdbvtnlfd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1808
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1280
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:552
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lfdbvtnlfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3856
  - - C:\Temp\i_lfdbvtnlfd.exe
      C:\Temp\i_lfdbvtnlfd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\faxvpnifay.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5324
  - - C:\Temp\faxvpnifay.exe
      C:\Temp\faxvpnifay.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4204
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2504
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1144
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_faxvpnifay.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4352
  - - C:\Temp\i_faxvpnifay.exe
      C:\Temp\i_faxvpnifay.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5444
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\icausmkicx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6024
  - - C:\Temp\icausmkicx.exe
      C:\Temp\icausmkicx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:248
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4340
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4128
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_icausmkicx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4652
  - - C:\Temp\i_icausmkicx.exe
      C:\Temp\i_icausmkicx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2328
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fzxrpkhcau.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1072
  - - C:\Temp\fzxrpkhcau.exe
      C:\Temp\fzxrpkhcau.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2404
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1368
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fzxrpkhcau.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2904
  - - C:\Temp\i_fzxrpkhcau.exe
      C:\Temp\i_fzxrpkhcau.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5016
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmhezxrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:944
  - - C:\Temp\pmhezxrpjh.exe
      C:\Temp\pmhezxrpjh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4348
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5444
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5400
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmhezxrpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2380
  - - C:\Temp\i_pmhezxrpjh.exe
      C:\Temp\i_pmhezxrpjh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2400
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hbztrmkebw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1036
  - - C:\Temp\hbztrmkebw.exe
      C:\Temp\hbztrmkebw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2336
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2900
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4128
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hbztrmkebw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5964
  - - C:\Temp\i_hbztrmkebw.exe
      C:\Temp\i_hbztrmkebw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jdbwtrljdy.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2752
  - - C:\Temp\jdbwtrljdy.exe
      C:\Temp\jdbwtrljdy.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1056
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3296
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:292
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jdbwtrljdy.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:552
  - - C:\Temp\i_jdbwtrljdy.exe
      C:\Temp\i_jdbwtrljdy.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ligbytrljd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5852
  - - C:\Temp\ligbytrljd.exe
      C:\Temp\ligbytrljd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2876
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4244
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2680
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ligbytrljd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4528
  - - C:\Temp\i_ligbytrljd.exe
      C:\Temp\i_ligbytrljd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vqnigaysql.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4312
  - - C:\Temp\vqnigaysql.exe
      C:\Temp\vqnigaysql.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1568
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3384
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4660
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vqnigaysql.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2180
  - - C:\Temp\i_vqnigaysql.exe
      C:\Temp\i_vqnigaysql.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3820
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kidavtnlfd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3936
  - - C:\Temp\kidavtnlfd.exe
      C:\Temp\kidavtnlfd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2692
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2764
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4620
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kidavtnlfd.exe ups_ins
    3⤵
    PID:3840
  - - C:\Temp\i_kidavtnlfd.exe
      C:\Temp\i_kidavtnlfd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1004
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cavsnlfdxv.exe ups_run
    3⤵
    PID:5604
  - - C:\Temp\cavsnlfdxv.exe
      C:\Temp\cavsnlfdxv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3200
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4572
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2372
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cavsnlfdxv.exe ups_ins
    3⤵
    PID:5476
  - - C:\Temp\i_cavsnlfdxv.exe
      C:\Temp\i_cavsnlfdxv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1356
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fcxspkhcau.exe ups_run
    3⤵
    PID:2388
  - - C:\Temp\fcxspkhcau.exe
      C:\Temp\fcxspkhcau.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4656
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4660
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fcxspkhcau.exe ups_ins
    3⤵
    PID:5540
  - - C:\Temp\i_fcxspkhcau.exe
      C:\Temp\i_fcxspkhcau.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3600
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mhezwupmhe.exe ups_run
    3⤵
    PID:4584
  - - C:\Temp\mhezwupmhe.exe
      C:\Temp\mhezwupmhe.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4364
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4172
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4440
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mhezwupmhe.exe ups_ins
    3⤵
    PID:848
  - - C:\Temp\i_mhezwupmhe.exe
      C:\Temp\i_mhezwupmhe.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3340
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wuomhezwrp.exe ups_run
    3⤵
    PID:1788
  - - C:\Temp\wuomhezwrp.exe
      C:\Temp\wuomhezwrp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3372
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4360
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1408
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wuomhezwrp.exe ups_ins
    3⤵
    PID:5296
  - - C:\Temp\i_wuomhezwrp.exe
      C:\Temp\i_wuomhezwrp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jebwuomgeb.exe ups_run
    3⤵
    PID:2680
  - - C:\Temp\jebwuomgeb.exe
      C:\Temp\jebwuomgeb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1144
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3644
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jebwuomgeb.exe ups_ins
    3⤵
    PID:2576
  - - C:\Temp\i_jebwuomgeb.exe
      C:\Temp\i_jebwuomgeb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4628
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\geywtoljgb.exe ups_run
    3⤵
    PID:2668
  - - C:\Temp\geywtoljgb.exe
      C:\Temp\geywtoljgb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1928
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3764
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:8
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_geywtoljgb.exe ups_ins
    3⤵
    PID:2540
  - - C:\Temp\i_geywtoljgb.exe
      C:\Temp\i_geywtoljgb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1132
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\olfdbvtqli.exe ups_run
    3⤵
    PID:4684
  - - C:\Temp\olfdbvtqli.exe
      C:\Temp\olfdbvtqli.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5040
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:804
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_olfdbvtqli.exe ups_ins
    3⤵
    PID:5300
  - - C:\Temp\i_olfdbvtqli.exe
      C:\Temp\i_olfdbvtqli.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4996
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqoigbvtnl.exe ups_run
    3⤵
    PID:1736
  - - C:\Temp\sqoigbvtnl.exe
      C:\Temp\sqoigbvtnl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4968
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5204
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqoigbvtnl.exe ups_ins
    3⤵
    PID:1120
  - - C:\Temp\i_sqoigbvtnl.exe
      C:\Temp\i_sqoigbvtnl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1124
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff8e487c188,0x7ff8e487c194,0x7ff8e487c1a0
      4⤵
      PID:940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,13368822776811164769,3643647690182724031,262144 --field-trial-handle=2312,i,13762236886087138298,12123632615341864324,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
      4⤵
      PID:2528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,15778202856583901490,18166376656070831333,524288 --field-trial-handle=2312,i,13762236886087138298,12123632615341864324,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:11
      4⤵
      System Time Discovery
      PID:252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2392,i,7630388119776576107,13624226601714218857,524288 --field-trial-handle=2312,i,13762236886087138298,12123632615341864324,262144 --variations-seed-version --mojo-platform-channel-handle=3208 /prefetch:13
      4⤵
      PID:52
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,5266265766148971344,2796389523955351316,2097152 --field-trial-handle=2312,i,13762236886087138298,12123632615341864324,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      PID:3940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,4901484907942953783,1460748551289559213,2097152 --field-trial-handle=2312,i,13762236886087138298,12123632615341864324,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:1472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,9323725605017316264,5795858430723900191,2097152 --field-trial-handle=2312,i,13762236886087138298,12123632615341864324,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:1
      4⤵
      PID:2660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,466863172752494,4544799750884369576,2097152 --field-trial-handle=2312,i,13762236886087138298,12123632615341864324,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:9
      4⤵
      PID:1764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,10996670557184003113,1223717909477783838,524288 --field-trial-handle=2312,i,13762236886087138298,12123632615341864324,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
      4⤵
      PID:2096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,15643128435622273268,881484131216998295,524288 --field-trial-handle=2312,i,13762236886087138298,12123632615341864324,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
      4⤵
      PID:3372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,17794327173180066766,4479417100013369075,524288 --field-trial-handle=2312,i,13762236886087138298,12123632615341864324,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
      4⤵
      PID:4068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,15937038957178491845,1315785623789260331,524288 --field-trial-handle=2312,i,13762236886087138298,12123632615341864324,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
      4⤵
      PID:5700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,15937038957178491845,1315785623789260331,524288 --field-trial-handle=2312,i,13762236886087138298,12123632615341864324,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
      4⤵
      PID:1196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,4815858131905498427,2611042571680140496,524288 --field-trial-handle=2312,i,13762236886087138298,12123632615341864324,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
      4⤵
      PID:1348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,14314928218334051537,509852477880162593,524288 --field-trial-handle=2312,i,13762236886087138298,12123632615341864324,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:14
      4⤵
      PID:1128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,14233170207032798044,12433174397147818826,524288 --field-trial-handle=2312,i,13762236886087138298,12123632615341864324,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
      4⤵
      PID:3296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,3213340639236107909,1341030599111740845,524288 --field-trial-handle=2312,i,13762236886087138298,12123632615341864324,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:14
      4⤵
      PID:872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,12348116227023077635,2602391350551309146,524288 --field-trial-handle=2312,i,13762236886087138298,12123632615341864324,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:14
      4⤵
      PID:2752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3720,i,11944166494881846994,2893088960516329565,2097152 --field-trial-handle=2312,i,13762236886087138298,12123632615341864324,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
      4⤵
      PID:5360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5296,i,4957621915376284031,5482426721599017853,2097152 --field-trial-handle=2312,i,13762236886087138298,12123632615341864324,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:1
      4⤵
      PID:6108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5352,i,6862009698062709578,4776885235490391324,2097152 --field-trial-handle=2312,i,13762236886087138298,12123632615341864324,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:1
      4⤵
      PID:460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,15949805940335372766,7080823222040316651,524288 --field-trial-handle=2312,i,13762236886087138298,12123632615341864324,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
      4⤵
      PID:1116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,2378134456924316822,2646216998765432954,524288 --field-trial-handle=2312,i,13762236886087138298,12123632615341864324,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
      4⤵
      PID:3600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,1367337996374505602,1450325308692324420,524288 --field-trial-handle=2312,i,13762236886087138298,12123632615341864324,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:14
      4⤵
      PID:3256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=3880,i,17003858716763539665,7307335230009738474,2097152 --field-trial-handle=2312,i,13762236886087138298,12123632615341864324,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:1
      4⤵
      PID:4632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,11308703752649648946,3655153908608906021,524288 --field-trial-handle=2312,i,13762236886087138298,12123632615341864324,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
      4⤵
      PID:5300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3736,i,7170168978772840190,7687138927788495193,262144 --field-trial-handle=2312,i,13762236886087138298,12123632615341864324,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:10
      4⤵
      PID:4832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3456,i,4172821915975249550,3939712096839299962,524288 --field-trial-handle=2312,i,13762236886087138298,12123632615341864324,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:14
      4⤵
      PID:4492

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2672

C:\Temp\ytrljdbvtolgeywq.sys
C:\Temp\ytrljdbvtolgeywq.sys
1⤵
- Executes dropped EXE
PID:804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4784

C:\Temp\wqligavtql.sys
C:\Temp\wqligavtql.sys
1⤵
- Executes dropped EXE
PID:3340

C:\Temp\ifaysqkifa.sys
C:\Temp\ifaysqkifa.sys
1⤵
- Executes dropped EXE
PID:5972

C:\Temp\pnkfaxvpki.sys
C:\Temp\pnkfaxvpki.sys
1⤵
- Executes dropped EXE
PID:2564

C:\Temp\usmkfcxupf.sys
C:\Temp\usmkfcxupf.sys
1⤵
- Executes dropped EXE
PID:460

C:\Temp\eczusmhfzx.sys
C:\Temp\eczusmhfzx.sys
1⤵
- Executes dropped EXE
PID:1124

C:\Temp\pjhbztrmjh.sys
C:\Temp\pjhbztrmjh.sys
1⤵
- Executes dropped EXE
PID:2044

C:\Temp\uomgeztrlj.sys
C:\Temp\uomgeztrlj.sys
1⤵
- Executes dropped EXE
PID:1672

C:\Temp\tqligeywql.sys
C:\Temp\tqligeywql.sys
1⤵
- Executes dropped EXE
PID:972

C:\Temp\ljdbvqoiga.sys
C:\Temp\ljdbvqoiga.sys
1⤵
- Executes dropped EXE
PID:2340

C:\Temp\sqoigaysqk.sys
C:\Temp\sqoigaysqk.sys
1⤵
- Executes dropped EXE
PID:3144

C:\Temp\nkfaxvpnif.sys
C:\Temp\nkfaxvpnif.sys
1⤵
PID:5632

C:\Temp\smkecxupnh.sys
C:\Temp\smkecxupnh.sys
1⤵
PID:4108

C:\Temp\fzxupnhfzx.sys
C:\Temp\fzxupnhfzx.sys
1⤵
PID:2520

C:\Temp\ebzurmkecw.sys
C:\Temp\ebzurmkecw.sys
1⤵
PID:1876

C:\Temp\pjhbztrlje.sys
C:\Temp\pjhbztrlje.sys
1⤵
PID:3712

C:\Temp\jgbztrljdb.sys
C:\Temp\jgbztrljdb.sys
1⤵
PID:3416

C:\Temp\trligdyvtr.sys
C:\Temp\trligdyvtr.sys
1⤵
PID:5360

C:\Temp\vsqoigaytq.sys
C:\Temp\vsqoigaytq.sys
1⤵
PID:4764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bywigeytnj.exe

Path C:\Temp\bywigeytnj.exe
Size 361KB
SHA256 6aae258a0923cfe3d042ae1ee3713fccfd539c22dcdccfb0ca71fb8cd5710736
MD5 2780d0c7f55a0c01b28012126c3b92ce
SHA1 e26f3237a800453872aba0857fa31479bb0ef945
SHA512 184209b16d4e93b1f156ff400eac3acca0887812bd1d2cfe6bde709553fffa15e7cec8fd45c80033c4c4afb96e1abd52e8e77fd3de5b88a6e9d2335eb6dcef27
SSDEEP 6144:fflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:fflfAsiVGjSGecvX
TLSH
T19A747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eczusmhfzx.sys

Path C:\Temp\eczusmhfzx.sys
Size 293KB
SHA256 4cdb33ca596d10bc29117baf7e72958cdbc18a8ec58f9cd208f01d305137234d
MD5 6b7abb3a9394f9cdd9ab317e4c9dba00
SHA1 fbe60c019f0e0cddeeda6cbec5c0f210ea9f22bf
SHA512 db876304a570d94c11cf35f29222e42cbb910b1973112fe460b70df3290fdee513ab3d2d17e6464748fe6bed74ec976daede2b9c16bc4b9119651e8e9d927cff
SSDEEP 3072:ktKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:kIJjiJcbI03GBc3ucY5DCSj
TLSH
T19F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faxvpnifay.exe

Path C:\Temp\faxvpnifay.exe
Size 361KB
SHA256 8ad8dbe5c667c8012ff4bc33a3bddaf4f59eabb0c411e4f36ceddb2e314453b6
MD5 a7123695167f9ab584bb62e783cc20cc
SHA1 c4d1c6f23fb25b4341fcc549c09d675c4f4bf1a5
SHA512 13a773e79fd58fe22d902feaed6ddd0b6e235f613d02745746e4718c6f94ec622d1846996d69c8f71af403750bfaca317d6959e69399d4c3f2acb36ad712b6d0
SSDEEP 6144:vflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:vflfAsiVGjSGecvX
TLSH
T139747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxrpkhcau.exe

Path C:\Temp\fzxrpkhcau.exe
Size 361KB
SHA256 eaf215999fa9fbb2956aa03b179b1164789c3073eab2886b1f184f8245d56d24
MD5 e615539f8d2ab9eaa9bcc5f1cb5c7502
SHA1 9fecceccf2deaeeccc62b66d0ebfe0263ae57139
SHA512 d79332981330841fdc317a186e131f97f8424f82f93606e1b4a33543b7567c5a4046df8e517b0f8921574eba1364fbae20ecc54aa7e38cafdddfb7ae9fbd426f
SSDEEP 6144:vflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:vflfAsiVGjSGecvX
TLSH
T1E4747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bywigeytnj.exe

Path C:\Temp\i_bywigeytnj.exe
Size 361KB
SHA256 f9fb30d16f0630728da83f3d40a3fab6dd7c87c4e9d0e7fb9eaa99ec30777e13
MD5 8c84095eb95b42724e3deeacbf04df75
SHA1 e6b327639eee5635bd92ed6d14ebb66c972e4600
SHA512 5958e807c41ca17b0e62b083636e647b5e94e10ecea48d355dedf94ee82d2f743bb01737e2004dddd9003ade2b7ba6d4cad60652b5902b09efe670a74c0fe592
SSDEEP 6144:5flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:5flfAsiVGjSGecvX
TLSH
T1CC747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_faxvpnifay.exe

Path C:\Temp\i_faxvpnifay.exe
Size 361KB
SHA256 5961857167d865544bd24de718060477af56cb8180a7ac0f13caea0693082bbc
MD5 dee02f07e34506d1d9c7b6e2734368cb
SHA1 9a28860434efb0727129fd91540f6cd18e8ed83a
SHA512 a9bde728dc5414a0ce6907739164043095563be9bee2059c22dd6f554ce7a16387a17e49aeacbace12a84030a77b744fe5e87cfc15f7fc6ca520328491e04a28
SSDEEP 6144:/flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:/flfAsiVGjSGecvX
TLSH
T110747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fzxrpkhcau.exe

Path C:\Temp\i_fzxrpkhcau.exe
Size 361KB
SHA256 b0471e282fa8958e5e3e05a1d411204d5c63d2a4d01663b7efe8e8823bcfd6c7
MD5 ef5c968f827ce53dd7cfcca426658d0d
SHA1 fc6e797dcd9a0fcb011f913ce3538d5a3367151c
SHA512 3027eefb9afc85671c25829274dc158878992ae42e60b09c1e0ba1b835eb26f694ac8f9c55b403447915f02aa386578bd8bce32f9fd185fe9fdbb976bce5f668
SSDEEP 6144:NflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:NflfAsiVGjSGecvX
TLSH
T11E747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_icausmkicx.exe

Path C:\Temp\i_icausmkicx.exe
Size 361KB
SHA256 c7d5ab7fb34dc72f41a3f1d4d7149c1d7260cff1837f616bcd32476a432dbf47
MD5 1e509050f482aa8d8cbca8a057dd164b
SHA1 8520ad49be8ce2cc147b47decd6a4efaf5424b57
SHA512 c8696c5a3ee12114a97af076d8ec1a727f8f56bf2a269e4c7bb9cb548f7c2e971a3a1a963dc6d8e471c96db23fe6c9e41f618942455ab9ec997c57e819028fb9
SSDEEP 6144:AflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:AflfAsiVGjSGecvX
TLSH
T159747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lfdbvtnlfd.exe

Path C:\Temp\i_lfdbvtnlfd.exe
Size 361KB
SHA256 1420c0961f728e3c0073ffb8908eb08e7bcf6346e748c9884de2b6b065a3c1d3
MD5 572fbc4c3c947d04dc3b0cb3c5842188
SHA1 5d3e1190c2b48a7c4524c64b317994201b7e9075
SHA512 afd8da12939e30a3db320ffb464bd1906063199b4014dbfdc5a3cc1872cc28a5d342a28e576ab686523b253b48257995979bd8d035881d12d563b21259b04622
SSDEEP 6144:yflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:yflfAsiVGjSGecvX
TLSH
T17D747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icausmkicx.exe

Path C:\Temp\icausmkicx.exe
Size 361KB
SHA256 7a8f2528b8ee196841e84e3f9de78d249fd91efec7d0dca798d2c0e0002ff338
MD5 561b50c8a855a4fe7a569c799105f303
SHA1 73342f33cab866fde4115d3052bf755397adc29d
SHA512 961cab9770d526134aca948517a4be5a713811212147e8803ca368c7dbd719eb7be715c888121ca1c5a3fec008913279d881c69eb4cec51b62e4c63fce4678d6
SSDEEP 6144:KflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:KflfAsiVGjSGecvX
TLSH
T1FF747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifaysqkifa.sys

Path C:\Temp\ifaysqkifa.sys
Size 293KB
SHA256 9bb7a95c9c4e5998931625518aa3266713f08f861c65b82eedcbee07104fcf44
MD5 0aa06e20a424595363cc11abe0fd14a0
SHA1 364f391314323a4564442cb9e90c01f4cb79d1fc
SHA512 79493ddfed3bb14e91f04aa8f4d0c3ea9f9d725e488ffb7b76681405fd8b4f0070067d6ca56ca6c19645f3f82132f3f84503be72a005f2fc173127e355c292ac
SSDEEP 3072:ytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:yIJjiJcbI03GBc3ucY5DCSj
TLSH
T103545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdbvtnlfd.exe

Path C:\Temp\lfdbvtnlfd.exe
Size 361KB
SHA256 fae29f7471b0b0c74cfca6b7ce82af131da36c0133ffdc7eb323fb06d06ca3ce
MD5 83dbfaf5b5cf948f3cd7db9c24fdcd99
SHA1 2e987b7f7c5c6ec28364d86b568f1a3e27dbc862
SHA512 92cdf6fabf53d3264a0817780065f39986427113788e1c57cd29c4cc8bcf73a31e25412f61ffffd7665622fdd7983ebb178364ec0cb207aed57b5094b8c16e4b
SSDEEP 6144:IflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:IflfAsiVGjSGecvX
TLSH
T1D0747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmhezxrpjh.exe

Path C:\Temp\pmhezxrpjh.exe
Size 361KB
SHA256 96449831b6fac48e655babdd85b32d1ce85fa65201a960acd0ff972537d1a593
MD5 e725add79b7822b02a100c83844ed38c
SHA1 d28ee8fd4042858a8143a0a675ef280ae059876c
SHA512 a721d703022840ed0cc19afc809b74e060e5baae076bcb79fc0218229911928d81dbd2a1716e128f6fd8b83a22497a5bd296060b7bb8598558cf6446122fd458
SSDEEP 6144:wflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:wflfAsiVGjSGecvX
TLSH
T1BD747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnkfaxvpki.sys

Path C:\Temp\pnkfaxvpki.sys
Size 293KB
SHA256 f29ceee0f75859cead355e6f8e09df4962425e30a5e10423cb7022ad20e4367c
MD5 bf2d3c78fbc86d53a8a6b4a95826aeb2
SHA1 52adffa023011fc6434a8b97d59156fc29ba93b1
SHA512 8a0d4a49afefc37df6e47859ae3b34de821caa38c2cd08440f0cc278c4c9c8638d8897927043ab5bfe84c3374445f4b7b13f657b41c618aa4af6bd35d2ac38d7
SSDEEP 3072:AtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:AIJjiJcbI03GBc3ucY5DCSj
TLSH
T155545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmkfcxupf.sys

Path C:\Temp\usmkfcxupf.sys
Size 293KB
SHA256 bc8b70cfcba2ee4bd47e32cb1dbf02182cc4ad4326b7b1b98ccd29007361053d
MD5 c4592f9674b4d930cf3abe30cee10866
SHA1 7c6e9daa0af9360442d027e731548bd629fd9743
SHA512 f3f96a1af818edade36840534e9a6352fd9cfcb11817537f3cd1990f4c98690991bfff71227a3c7ad3913b7180f5e3018b527e8e4d907c7489697f6199a1d4ef
SSDEEP 3072:ntKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:nIJjiJcbI03GBc3ucY5DCSj
TLSH
T19F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqligavtql.sys

Path C:\Temp\wqligavtql.sys
Size 293KB
SHA256 72a0336c2748cbdd4f266f6e9cfd265ad8b276fc54340d462214892fcc5fc8e3
MD5 01664f22c551d3ba16d09899dbf9c972
SHA1 c324f5bac2f8fb831b82c0712aab7a952620ed70
SHA512 3f4338f29843c4a5f858bcf46b0fb34c87688b543cb6a4852dffb1d696999e10efb4aba3db4df895102ca486ff323fd2fceafea334458ad4ee61ca4125ce3551
SSDEEP 3072:9tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:9IJjiJcbI03GBc3ucY5DCSj
TLSH
T1A5545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytrljdbvtolgeywq.exe

Path C:\Temp\ytrljdbvtolgeywq.exe
Size 361KB
SHA256 87692dc464702c60b896a161ab6d3aa84d01e50f8bd3cd84d30c4efd16d867c4
MD5 329115fa86f0aebc5d15a7b345593d34
SHA1 1fee7ff4f1f3c0b683579f4a565d8252bbce1fba
SHA512 44974056e5d25efa964bb392e699048323737fb5dd54bb14f9128df09394faeb9f958de09fafc880c2cbfd79c3204869dceecc1fef6997d2a1a032b994683b01
SSDEEP 6144:RflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:RflfAsiVGjSGecvX
TLSH
T1C7747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytrljdbvtolgeywq.sys

Path C:\Temp\ytrljdbvtolgeywq.sys
Size 293KB
SHA256 2ae55d285c89b03123d155ea3d89b5a14cb0c45cf803f2efa80f131db741273e
MD5 ce3c76eb4b9d9fab9932a44cb061d18d
SHA1 3763063f5e30f3601c52cf738885669c622c9768
SHA512 de6a540125b7248d8dc14978b95e4e74409d13197db26d30a61fc5566b9dae968b1fa74d903d6b4d85fdbaab7e99755ff8667432bf2569cefbd11d52f78095e9
SSDEEP 3072:jtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:jIJjiJcbI03GBc3ucY5DCSj
TLSH
T1B6545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18a644ba613d5b4137dabc346f57eca622b6888922eaec751025ab3c0a002fd5
MD5 5eddc74c05def624cfd47ea0a7e304a5
SHA1 b5f795fcc3846bb781e66e0373fce119975b2659
SHA512 1c777d774c154e89b80817ce7344495d83eecf133c36e0ad7c60dd14d76e628697535cc3fc379ca4eeb776f3bea5096f94d0fd76a2394ecd2e52f5ca8dc0053f
TLSH
T133D09B5672455C4CD641343224E55217E3008821654546194353F0768DD668717ABD9A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da739d58d61b2ac7b5d9bb7ad60982cb15b364d9c7c9297fd0c9719c271cd985
MD5 2d2e0ac0da9a175b4b6a8be7c9d51cce
SHA1 ff15c8a5ff11faefae3f7491c7968a2163702b81
SHA512 0ae78f15909f04e1a81109917b8eeb5b8062a49558d8a40f15c02076b087f36e82b88b329e9d984fc68c62cb15408123b9db7f705f2745bfefc30b5aa2e164e6
TLSH
T1EAD09B5A72455D4CD641343224E55217E3108821754546194253F0768DD668717ABD9E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ad76b286fe56bed09db2a3648ba8d68538197fa7d7d191cee098d996267eca49
MD5 949ff9602f5a4d67e4d0d58226ee8579
SHA1 ee700bbcb11df202d218f78889e21d616c6e33e0
SHA512 29a582757eb443a1961b9c037bc3a1edb9c43c90ac7f371db57160c7b4d048524aef569924b6aefbfaca11be49ebed0235c92c54ab6f97f4e5566e755b91f651
TLSH
T16A614191732F0791DB27EEBA17D1E4C5B1F86816A20B6A00DC847DB4E086F167EE8467
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59cb36.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59cb36.TMP
Size 3KB
SHA256 15e1f0bdf5cddaa2e281ae74b0a7c7e26980d2cdd09b1290af6cc6b37e0ac6e9
MD5 eb645f2d71e35134c674005e8e2c4b0e
SHA1 af38c004508c0fa6bd940e42a6f1d7412f71e16a
SHA512 801ec8f8c444dcb77ceef1de0d8913c88d33cc658ed7dc8899bf8cf9b211fbb17567bd294a81d1cc48bd6479d63f0870e8674dffd6dc5ba9d42bd46fc38acec6
TLSH
T13D614291732F0791DB27EEBA17D1E4C5B1F86856A20B6A00CC843DB4E086F167EE8467
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f5ee788520491710392e560eeb599cc0b46e526f0022d7402f08798a2ba6cb39
MD5 3284208521c48b886901cc492a6b05b7
SHA1 a85a150d6be503f452f60bb94192c7a4d14c47b8
SHA512 134e39db13270b67f9960b42926f686ca997e60b116a1a4fe9bd684ebaf9e1112d62ff11c8132d92cdbab15ddfbdcff7d444539ce124fd6c3d97bd7d5de60dd6
TLSH
T10341DEF3C7E4866EC90196F0AA187E2BCE1D0914432C3D5AC9E4EF1B93E2471E142A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ba767ec5bcc071494bd73d7cfe33055157d65fb756db6015c4e51040c1c7fc0a
MD5 cc0e04344e6eaeab3bafb655aa87ef0b
SHA1 2aa5e87840a969d0e821753a161305b90394c18e
SHA512 4489ed7994ab146bd2eaab10893ec46a1cba5de7d766231c39a4db737e2cfdc5768d117a7ca098900c815782df1ef3995a0a04b7673d466f15202bf8c70c7372
SSDEEP 192:sxRHR7JyM/jK1Ml8wCC/fasIZn8Z5hzoA8pi/g6+WNIYEu32GDRIgtJ:sxRHd8C/fasEnC5ci/5ISH3
TLSH
T15152DA166A285D3BDCDBD20DFA517F93D6F81573A1901E44AAFCCA0C04E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 1e84c4e312b00b9a16068ac30fbb03f46a80a9105e20453384daa1e688942c2d
MD5 1531dcba8a39a711c153054751407093
SHA1 54c54725bcfd3b8c6b0272a2b09fc76c424ccaaf
SHA512 1f015cfcb90bdf22f5fd28044bd256650f15588c5406776a905dc0c1cd1f7b8a54d6781142d26603722b2898000c0fb5bbcca0f4063597300f40c42599cfabc8
SSDEEP 192:sxRoR7JyM/jK1Ml8wCC/fasRZn8Z5hzoA8pi/g6+WNIYEu32GDRIgDfJ:sxRod8C/fas/nC5ci/5ISHF
TLSH
T10662DA166A285D3BDCDBD20DFA517F93D6F85573A2901E44AAFC8B0C04E6AED211381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 92e06ae455164016cf9ee5c512a82970d7032b4e335e7a2f9c09d8cef2d23bcb
MD5 d07ad68dbc19a07d5b108047b0349761
SHA1 68d74da8c4375f2fc8277cbfe795157f6ff55b65
SHA512 a740b3244d4f151d79c384bab2ee290aed85ae5164f3e0f70aa772cf858cd60bb6c7cba727ef1ff24322ea9e39a1f5bf4579c88037a6ee9fbf43f14d34a2b5d0
SSDEEP 192:sxRoR7JyM/jK1Ml8UQ6CC/fasRZU8Z5VzoA8pri/g6+WNCc0/YEp32GDRIgDFJ:sxRofq9C/fas/UC54m/5+/ZHD
TLSH
T13462C816AA285D7BDCDBD20DFA517F93D6F85573A2501E44AAFC8B0C00E6ADD211381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 4d0bd7e6c8a99d8d4b1aa4e3417d3313a9b53b93e5ddf3b63d3eb721aa91a27c
MD5 66b4e7afc278c9b93734e9c0173d249c
SHA1 f50a5b8b2a974c87aae359162c1690913d9e28cc
SHA512 fc2b5aebd5362fc1ade190e3bf1827380f3532a1f5a3ec5186ce014248753e14166ef8c9b74da0478eeeffc854e0769e6d28e3bf6f1f729781c013dfb24cc7bd
SSDEEP 192:sxRoR7JyM/jK1Ml8wCC/fasRZU8Z5VzoA8pri/g6+WNCc0/YEp32GDRIgDFJ:sxRof8C/fas/UC54m/5+/ZHD
TLSH
T18562C916AA285D7BDCDBD20DFA517F93D6F85573A2501E44AAFC8B0C00E6ADD211381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 d051fb384c3f147433a7740a77aa93610457c6ccaecb9bd98640c7dbf2629a41
MD5 c690d8ec062ffddb0ba9f8a25b28020b
SHA1 3e3dd9c9767fedd7f11d1469200ebd223a198056
SHA512 7b4f285e3d3aa883bb75117aad8839f89333052ea128eccf6e4372b73932eb91d5da3d8a7824ae8fbb2a52655735aedc54558823f408f78c0e09828c27eb8947
SSDEEP 768:40D76DrQD81F7pLuL7J0DbWgQ6DjfPQDF8F1+UoAYDCx9Tuqh0VfUC9xbog/OV2J:40D76DrQD81TE7J0DbWgQ6DjfPQDFu1+
TLSH
T1C0E2EC3B680CCB7F4F404ADDAC29BDDA6DA801CB96D8899447EA880C03C67EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a669b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a669b.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 adeb7e873baaa32371ba22dc831d0e67e52d964023a6e75e0fcef246fc8310bd
MD5 5fb5044a5ae8c4f5e86b1371d3d01e83
SHA1 2d1260136032fc34e914ccce2d2ffd8498e617f1
SHA512 c441aa0df2c2957d6a8da96193c5e2fe850100f3c3b08bef9ce953865c7ba30fe076be58dca7d81ef52774afadfdf9cfca5844fc6634dcebe331e5620a5a7ec7
SSDEEP 768:lrv+4UNbdz3gJFs/ulkDTd+ZgtxtUeX6+qTko0u229a4vsTt/eVH1Sdq:lbsbR3gJFsgQvVTVKa4i/EH1R
TLSH
T14013BF32A8689D3389E7D784B14735876FB82273CAC80B84D9DE9B0D058759C270FD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 1920cc6bc1f13bafeae161b4015cc6af1b65d254048655c7eb6ad6ce335de1fe
MD5 95abc62bfe3765035cc18b23210413d8
SHA1 2fdbcf0b390bc57393a57aee0497de8b918b6535
SHA512 5f47b5ab96f92b80312c329251e3034b670146141caf9a0c726f80f3c751ff318ed42a883f8149331862e3f3ed56b0e008ea44771564b3dd61d4df02df6904b7
SSDEEP 768:prv+4UNbdG31TXqDTd+ZgtYeX6+qTko0u229a4vsDPeVH1SdW:pbsbU3h0vVTVKa4uEH1h
TLSH
T17C03CF32E8648D778CE79784714B75472EB96163CBC80B80D9EE6B0D069B5AC230BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 f7a144af8928aeb8514beac18c82f1ee85dfa3058c544f60d1040483914423d8
MD5 e7db6e7641bcd36b3ef12ffa6bb0fa63
SHA1 3f63799a4f5e6085deddfd2ec1c50f7730eb86fc
SHA512 b849a3997bcc2e15380aebee4dc8327bf38129f84facc52dbd4f3af47e8ec0b073b6dff48682c0f2007f8d1ad2c8e4a5feac0554c5526259a7c83a0a35edc4ee
SSDEEP 768:dFKj+953pwgBFs/TlznZgtxtFeX6+qTko0u229a4vsTt/b9Mnb:F953pFsnjvVTVKa4i/b+nb
TLSH
T130038D36EC55CE6799E78BC5B3563A8B9EE41273C6C859C4EADD6E4800831EC170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 6980d9842366ccd2c7fcf0ddd4be082ac4418f6ee21b1afdebdb529026c34914
MD5 2f27fb47f7d18646bb51e58a0a9f1671
SHA1 d79d02399e1926a51ee37ec61a56bf3c83931f26
SHA512 a538d6548b394f722d2d7ef197191d712df608c0dfc3b6658d298477d1bfea4a2ef3ec8496198ada2e9c6abf9df72ab1398f3f940d3cc64564210b4fdefe0039
SSDEEP 768:6rv+4UNbdz3cJFs/ulkDTd+ZgtxtqeX6+qTko0u229a4vsTt/eVH1Sdq:6bsbR3cJFsg0vVTVKa4i/EH1R
TLSH
T1DA13BE32A8688D3389E7D784B14775876FB82273CAC80B84D9DEAB4D454759C270FD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 4c28ff2eb085ff03392fc18ecbbaaf1788e66bfeddb984565314925d3c81dac4
MD5 95983df49c6b85c02dd5e013d399f81f
SHA1 1984d8d0c05ded530ae35748fc3de574160061a5
SHA512 4209236314326c92c9fb0d576529c5325c6c956595656faff3d3c0c1e76fe79fae6cbe8a45ce6069f88136c2000ca19d632a372d7548637f9fc2e121ba625ba9
SSDEEP 768:Hj+9V3DFs/TlkDTd+ZgtxtJeX6+qTko0u229a4vsTt/b9Mnb:q9V3DFs7rvVTVKa4i/b+nb
TLSH
T102F2BF31FC255D738896D795725B3A97AFF41273C6C81E44EADDAB0C05836AC270B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

889f6451-4a1c-4735-9f2f-557774ab714f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\889f6451-4a1c-4735-9f2f-557774ab714f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5716_1596639713\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 ecf5abfd2698e10fd4458d97f3475adec3b5d6fa807352b774fa7d27b1a3d542
MD5 cc0fe74450963d264dab3173ab3d6af1
SHA1 de4a50b662f733bdc833fe139605f671e25e2501
SHA512 557502cdc81840378d53566fd1224e0021dbb36352f9d0551eaf42b8b03b9c21803067b08fc3f0b29d3098bd9d1d35d75cf97523b06f6f82cebadda0f85dbfa6
TLSH
T15B71278357A8D5B3C1DE5BF502835644F5FB1238073331200B51599BE730A7664B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/460-277-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/804-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/972-334-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1124-316-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1124-307-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1672-319-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1876-432-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2044-314-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2340-355-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2520-428-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2564-261-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3144-368-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3340-186-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3416-472-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3712-443-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4108-408-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4764-501-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5360-476-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5632-388-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5972-233-0x0000000000010000-0x00000000000AB000-memory.dmp

Download